AI agents are software. Your exposure model already knows what to do with them.

Start with what an AI agent actually is

An AI agent installs. It executes. It spawns child processes. It reads files. It calls tools. It reaches credentials.

Strip away the interface and the model behind it, and what runs on the machine is a process with an identity, a privilege level, and a set of things it can touch. Coding assistants write and run code. MCP servers broker access to internal systems. Agents pull in other agents as dependencies.

That is software. Security teams already have a model for software.

Where the AI conversation drifts

Most AI security discussion happens one layer up, at the prompt and the response. Is the model being manipulated. Is sensitive data going into it. Is the output trustworthy.

Those are real questions and they deserve real controls. But they describe what the agent decides. They do not describe what the agent can reach if it decides wrong, or if someone else decides for it.

That second question is an exposure question, and it has familiar answers.

The four things worth knowing about any executing agent

Execution state. Is it running, or is it just installed somewhere? Software that never executes is not exploitable. Software that runs constantly on 200 developer laptops is a different conversation.

Privilege level. Is the agent running as a standard user, as an administrator, or as SYSTEM or root? The same agent behavior has very different consequences at each level.

Network exposure. Is it accepting inbound connections? Is it reaching destinations nobody expected? A local agent that opened a listener is not the same asset it was yesterday.

Blast radius. What is reachable after a compromise? Which credential files can it read, which systems does its token unlock, what did it write to disk and then execute?

None of these require knowing what the agent was asked to do. They require watching what it does.

Why this matters for coverage

Most AI agents in an enterprise did not arrive through procurement. They arrived through a developer who wanted to move faster, or a power user who found a tool that worked. There is no ticket, no vendor review, and no inventory entry.

Any approach to AI exposure that starts with a list of approved platforms is describing a smaller population than the one that exists on the endpoints. The agents most likely to create an incident are the ones nobody wrote down.

Discovery has to come from observation. If the agent runs, something on the host should see it, without the agent registering, integrating, or cooperating.

The practical takeaway

You probably do not need a separate AI risk program with its own score and its own queue. You need your existing exposure model to include a class of software it has not been watching.

Same evidence. Same prioritization. Same remediation shortlist. One more thing running on the endpoint that your team should be able to see.